PM_EVT_CONN_SEC_FAILED error after reconnecting

[Pavan Kote]

Once paired & Bonding is completed. If neither side pairing & Bonding information is deleted. After restart the device is not advertising again. We are getting PM_EVT_CONN_SEC_FAILED.

How can we overcome this if we get this error.

[Einar Thorsrud]

Hi,

Do you mean that after bonding, you do not delete the bond on any of the devices but still you get PM_EVT_CONN_SEC_FAILED? Are both devices nRF devices, or is one of them another device? If so, which? Which SDK version do you use? Please elaborate.

The typical reason for getting PM_EVT_CONN_SEC_FAILED is if one of the devices has deleted the bonding information. If so, the nRF can be configured to allow repairing if that is the problem, and that is not a security concern. See this post.

[Pavan Kote]

Hi,

Yes I am getting a PM_EVT_CONN_SEC_FAILED event. My peripheral device is NRF Module & Central device which we are using is Windows Application. 

My current setup peripheral deleting bonding information on every boot & windows side having bonding information.  I am already enabled allow_repairing to true. 

In  a condition the central device link is not properly closed because of some error condition and we restart our device. How can we tackle situation.

[Pavan Kote]

Hi,

Can we send some event to windows ble so that windows get to know that peripheral device didn't have the bonding info.

so we have to delete the bonding information on windows as well. Instead of doing manual delete on windows side. Is it possible.

[Einar Thorsrud]

No, it is not possible. If it was possible it would make it very easy for an imposture/attacker to replace an existing bond, and for this reason automatic re-pairing is not allowed.

[Pavan Kote]

Hi,

It means not possible to sync both when neither devices deleted bonding information. Is it correct.

[Einar Thorsrud]

I am not sure what you mean. Can you elaborate?

[Pavan Kote]

Suppose we want to delete the existing bonding.

What is the procedure we have to follow. Who should initiate the Bonding deletion Event.

[Einar Thorsrud]

The user would have to delete the bond on the Windows machine, and the user would have to delete the bond on the nRF. Once both sides have deleted the bond they can pair/bond again.

However, on the nRF side it is possible to allow repairing, if you do not see any relevant security issues with it. If you want to do that, follow the description in this post. It is not possible to do the same on Windows, so if the bond is deleted on the nRF, you will need to delete the bond on the Windows computer regardless of if the nRF allows repairing or not.